OK,
I figured this out for myself. Wasn't sure which logfile to look at. Is
in /var/log/xferlog. So this is what an access attempt looks like.
Sorry for the noise.
Chris
Chris Bennett wrote:
quoted text > I just found the following doing ps -auxw:
>
> root 10526 0.0 0.2 500 1052 ?? S 6:19PM 0:00.01
> ftpd: zeus.eanet.cz: [priv pre-auth] (ftpd)
> _ftp 10361 0.0 0.2 504 924 ?? S 6:19PM 0:00.00
> ftpd: zeus.eanet.cz: connected: USER admin (ftpd)
> root 27896 0.0 0.2 500 1052 ?? S 6:19PM 0:00.01
> ftpd: zeus.eanet.cz: [priv pre-auth] (ftpd)
> _ftp 253 0.0 0.2 504 928 ?? S 6:19PM 0:00.00
> ftpd: zeus.eanet.cz: connected: USER admin (ftpd)
>
> What should I make of this? I immediately killed ftpd. Is this a
> successful break-in or just an attempt?
> I will be carefully looking around the system right now.
> Chris
